Cisco ISE CVE-2026-20309

Exploitation requires an attacker to persuade an authenticated user of the ISE web-based management interface to click a crafted link (UI:R), so success depends on social engineering of an interface user rather than a direct server hit. The attacker themselves needs no credentials (PR:N) and no non-default configuration is required - any deployment exposing the ISE admin web interface is affected. Limiting factors: the payload only executes in the victim's browser (C:L/I:L, no A impact), the victim must be a legitimate interface user who takes the action, and restricting admin-interface access to trusted management networks materially reduces exposure.

This is a moderate-severity reflected cross-site scripting flaw (CVSS 6.1, CWE-79) in the Cisco ISE web-based management interface. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, low-complexity issue requiring no attacker authentication, but the mandatory UI:R (victim must click a crafted link) and the low, browser-scoped C:L/I:L impacts are the key limiters - this is not a server-compromise bug. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Reflected XSS is inherently a targeted, social-engineering-dependent attack rather than automatable mass exploitation, which is consistent with the low real-world urgency despite the 'unauthenticated remote' framing. Net assessment: a legitimate defense-in-depth patch priority for the admin interface, but a lower priority than the authenticated SQLi, path-traversal, and deserialization flaws in the same ISE line - verify no session-hijacking amplification via vendor advisory cisco-sa-ise-xss-Uz9VWRQ.

An attacker crafts a malicious URL targeting the ISE web management interface with an unvalidated parameter containing script, then socially engineers an ISE administrator into clicking it (e.g., via phishing). When the admin's browser renders the reflected response, the script executes in the context of the ISE interface, letting the attacker run arbitrary script or steal browser-based session information. No public exploit code was identified at time of analysis.